Cisco FMC flaws under active attack by ransomware crews

Cisco FMC flaws are under active attack, and the company that makes the product says three separate threat groups have been exploiting two recently patched vulnerabilities in it. Cisco FMC, short for Secure Firewall Management Center, is the central console that IT teams use to set up, monitor and control the Cisco firewalls protecting a network. Because it stores firewall rules, administrator logins and a live picture of the network it guards, it is an attractive place for an intruder to stay. Cisco's own threat research team, Cisco Talos, says it identified three clusters of activity on FMC instances that had already been compromised, and that these clusters are associated with criminal ransomware operations and with state-sponsored actors.

The first of the two flaws is CVE-2026-20079, rated 10.0 on the CVSS scale, which is the maximum severity score. It is an authentication bypass in the web interface of FMC software. In plain terms, the login check can be skipped altogether: an attacker who can reach that interface over a network needs no account and no password, and can run script files on the affected device to obtain root access to the operating system underneath. Root is the highest level of control on a machine. A CVE is the standard reference number given to a publicly catalogued software flaw so that people can look it up, and CVSS is a widely used scoring system for how serious a flaw is. The second flaw, CVE-2026-20316, is rated 5.3 and allows an unauthenticated, remote attacker to log in to an affected device using a low-privilege account and reach sensitive data held on vulnerable systems. Cisco notes that it can also be paired with other Cisco Secure FMC vulnerabilities to raise an attacker's privileges further.

Cisco Talos described three clusters of post-compromise activity, each tracked under its own label. The first, UAT-12197, exploited CVE-2026-20079 to deploy web shells, which are small scripts an intruder leaves on a server in order to return later and run commands through it, written in the Java Server Pages (JSP) format, together with a command execution tool packaged as a Java Archive (JAR). According to the research team, the goal was to query internal databases and obtain user authentication data and credentials. The second cluster, UAT-11823, exploited both flaws to deliver a reverse shell built on Netcat, a long-established networking tool that can open a command channel from the victim's machine back to the attacker, along with two bash scripts designed to harvest the configurations of the managed devices, and a variant of Cyclops Blink, a modular implant for Linux systems that Cisco says was previously attributed to Sandworm, a group it links to Russian state-sponsored activity.

The third cluster is the ransomware operation. UAT-11988 used CVE-2026-20316 for its initial access, then deliberately lived off the land: rather than bringing in purpose-built malware, it used legitimate tooling already built into FMC, so that its activity blended in with ordinary administration. Talos says this group carried out extensive reconnaissance of the victim's environment, dropped tunnelling tools to keep its network access open, collected credentials, built a target list of endpoints to encrypt, terminated security tools, and then deployed Qilin ransomware on the systems it had selected. Ransomware is malicious software that locks up files or systems and demands payment to give access back, and a tunnelling tool hides and carries an attacker's traffic through a network.

Cisco's guidance to customers is direct. The company said: "Customers are strongly advised to apply hotfixes for affected software versions already released by Cisco for CVE-2026-20079 and CVE-2026-20316." Cisco adds that it intends to ship a comprehensive hardening release next week covering various vulnerabilities it discovered internally. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog, a public list of flaws confirmed to be used in real attacks. A listing there requires Federal Civilian Executive Branch agencies to apply the patches by September 12, 2026. The second vulnerability, CVE-2026-20316, was added to the same catalog in late July 2026.

What does this mean if you run a website or a business network? The pattern here is a familiar one and it is worth taking personally. The entry point is not a clever new trick but a management interface that is reachable over a network and still unpatched, and the damage is done afterwards, quietly, using the victim's own tools. That is why the two things that matter most are speed and exposure: getting the vendor's hotfixes installed on every affected system, and making sure that administration panels are not open to the whole internet in the first place. Because the FMC console manages firewalls, the credentials and configuration data it holds are exactly what an attacker needs to move deeper into a network, so a compromise there is rarely contained to one device. Anyone who is unsure whether their own firewalls or management software are affected should ask their IT provider directly, and ask for a specific answer about these two CVE identifiers rather than a general reassurance. Where organisations do not have in-house specialists to track patch releases and the exposure of management interfaces, AEU-I provides security-first IT, infrastructure and consulting, and its service page sets out the kind of ongoing hardening and support work this upkeep involves.